Security Scan: Human verification

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/90009556-3876-4965-b7aa-9ec5f36310ce Domain and IP registration (RDAP)/api/v1/rdap/90009556-3876-4965-b7aa-9ec5f36310ce Certificate Transparency/api/v1/ct/recaptcha.cloud How often this domain was scanned/api/v1/domain/stats/tribot.co.uk Scan history for this domain/api/v1/domain/history/tribot.co.uk?limit=15

This website contacted 12 IPs in 4 countries across 6 domains to perform 13 HTTP transactions. The main domain is recaptcha.cloud and was registered 18 years ago.

Submitted URL: https://tribot.co.uk/Tribot.jar

Effective URL:

https://recaptcha.cloud/?template=cpg&server=198.251.89.220&ip=178.63....

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 93%

Risk Score

Malicious JAR download (tribot.co.uk/Tribot.jar) flagged as a stealer by two independent feeds, gated behind a fake 'cPGuard' human-verification page on recaptcha.cloud that references the flagged C2 IP 198.251.89.220.

Risk Factors (5)

Multi-source corroborated malware (stealer) indicators against both the scanned URL (/Tribot.jar) and the C2-style IP:port 198.251.89.220:443 carried in the redirect query string

Interstitial fake human-verification/CAPTCHA page on an unrelated domain (recaptcha.cloud) that mirrors Cloudflare/cPGuard styling while redirecting back to a malicious JAR download

Obfuscated JavaScript detected by network IDS (HIGH, 'ptth' reversed-string obfuscation) plus one eval() call

Deceptive brand framing: the page asserts the URL is 'protected by cPGuard' and shows 'HUMAN VERIFICATION FAILED', pressure/urgency text designed to push the user into completing the check

Binary (.jar) payload delivery on a domain unrelated to any software vendor, fronted by a challenge page that exists solely to gate the download

Domain age information unavailable

Details

Page Title

Human verification

Scan Type

public

Domain Name Analysis

Domain 'tribot.co.uk' uses the United Kingdom country-code top-level domain (.co.uk) with no subdomain. The second-level label 'tribot' is 6 characters long split between two vowels and 4 consonants. Word splitting yields two words: tri, bot. The median word length lands at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

3.21s

Total Load Time

923 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:54%

Script:Latin

Direction:ltr

Detection Details

Text Length:457 chars

Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence

Type: static

Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
2	95.217.5.229	Helsinki, Uusimaa, Finland	AS24940Hetzner Online GmbH
1	198.251.89.220	Luxembourg, Luxembourg, Luxembourg	AS53667FranTech Solutions
1	142.251.110.95Google · CDN	United States	AS15169Google LLC
1	104.18.95.41Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	142.251.13.95Google · CDN	United States	AS15169Google LLC
1	142.251.14.94Google · CDN	United States	AS15169Google LLC
1	88.198.131.116	Falkenstein, Saxony, Germany	AS24940Hetzner Online GmbH
1	142.251.14.95Google · CDN	United States	AS15169Google LLC
1	142.251.127.95Google · CDN	United States	AS15169Google LLC
1	104.18.94.41Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
13	12	-	-